A critical stack-based buffer overflow in the Extreme Networks IQ Engine allows authenticated attackers to execute arbitrary code.

This vulnerability is a stack-based buffer overflow (CWE-121) within the Bonjour Gateway component. It can be triggered via the ah_event_send function, specifically impacting the ah_auth service, and is reachable through the ah_webui service listening on TCP port 3009.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary code on the affected IQ Engine. Given the CVSS score of 8.8, this poses a high risk to system integrity and availability, potentially leading to a full compromise of the networking device and unauthorized access to the underlying management infrastructure.

Immediate Action: Upgrade Extreme Networks IQ Engine to version 10.6r1a or 10.6r5 immediately to patch the buffer overflow.

Proactive Monitoring: Monitor network traffic directed at TCP port 3009 for anomalous patterns or unexpected service interactions that may indicate exploitation attempts.

Compensating Controls: Restrict access to the ah_webui management interface to trusted administrative IP addresses using network ACLs or firewall rules to minimize exposure.

Public Exploit Available: No

The severity of this flaw, combined with the potential for remote code execution, necessitates immediate patching. Organizations should prioritize updating their IQ Engine firmware to the remediated versions to eliminate this critical security risk.